Network Isolation and Segmentation CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security engineer is evaluating the benefits of network isolation for a new cloud deployment. The engineer wants to reduce the attack surface and contain potential breaches. Which of the following is a direct benefit of network isolation?

   • AIt eliminates the need for encryption of data in transit.
   • BIt guarantees that no external attacker can reach any resource in the cloud.
   • CIt removes the need for monitoring and logging of network traffic.
   • DIt limits the ability of an attacker to move laterally from one compromised resource to another.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A cloud architect is designing a network for a financial application. The application has a public-facing web tier and a private database tier. The architect wants to ensure that the database tier is not reachable from the internet, but the web tier must be able to access it. Which combination of constructs should be used?

   • APlace both tiers in the same public subnet and use security groups to restrict database access.
   • BPlace the web tier in a public subnet and the database tier in a private subnet; use a network ACL on the private subnet to deny inbound internet traffic.
   • CPlace the database tier in a public subnet but do not assign it a public IP.
   • DPlace both tiers in a private subnet and use a NAT gateway for internet access.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A cloud administrator is setting up a new VPC for a web application. The application has a public-facing load balancer and a set of private application servers. The administrator wants to ensure that the application servers can only receive traffic from the load balancer. Which security group configuration should be applied to the application servers?

   • AAllow inbound traffic from the VPC CIDR.
   • BAllow inbound traffic only from the load balancer's security group.
   • CAllow inbound traffic from 0.0.0.0/0.
   • DAllow inbound traffic from the load balancer's IP address.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which approach is recommended to separate development, test, and production environments in a cloud architecture?

   • ADisable network monitoring for non-production environments
   • BUse separate VPCs or dedicated subnets for each environment
   • CPlace all environments in the same subnet to simplify management
   • DUse the same security group for all environments
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security engineer is explaining the benefits of network isolation to a non-technical stakeholder. The stakeholder asks, 'How does network isolation help if an attacker compromises one of our servers?' Which response is most accurate?

   • AIt prevents all malware from being installed on the server.
   • BIt makes the compromised server immune to further attacks.
   • CIt prevents the attacker from moving laterally to other parts of the network, containing the breach.
   • DIt automatically removes the compromised server from the network.
   Reveal Solution Discussion Select an answer first